Hi, Ioctl commands are unsigned int values, with conventionally encoded size and direction fields above bit 15. However, struct lsm_ioctlop_audit stores only a u16 and the common audit formatter uses %hx. SELinux also narrows the command before constructing this audit data. As a result, LSM audit records can conflate distinct ioctl requests; for example, Landlock currently records 0xc00ffeee as 0xfeee.
The narrow audit field dates to its 2015 introduction [1] alongside SELinux ioctl extended permissions. Using the low type and number bytes for those policy checks was deliberate, but the mailing-list review contains no separate decision to truncate the audit value. Audit discussion instead identified ioctlcmd with the ioctl request in syscall argument a1, and the audit field dictionary defines it as the request argument to ioctl. This also exposes an audit2allow -x assumption: it copies ioctlcmd directly into a 16-bit SELinux extended-permission rule. It needs to derive that rule from the low 16 bits of the full audited request; otherwise checkpolicy rejects generated values above 0xffff. Patch 1 preserves the full command in shared audit data without changing SELinux's low-16-bit policy checks. Patch 2 updates the existing Landlock test to exercise upper command bits. [1] https://lore.kernel.org/r/[email protected] Mickaël Salaün (2): lsm: Preserve full ioctl commands in audit records selftests/landlock: Check full ioctl commands in audit records include/linux/lsm_audit.h | 2 +- security/lsm_audit.c | 2 +- security/selinux/hooks.c | 6 +++--- tools/testing/selftests/landlock/fs_test.c | 10 +++++++--- 4 files changed, 12 insertions(+), 8 deletions(-) -- 2.55.0
